CMMC 1.0: The DoD made cybersecurity maturity a condition of doing business

In January 2020, the Department of Defense launched a program that would change how defense contractors think about cybersecurity. The Cybersecurity Maturity Model Certification, or CMMC, made cybersecurity maturity a formal requirement for doing business with the DoD, replacing a system of self-attestation that had proven inadequate. For the hundreds of thousands of companies in the defense supply chain, it was a wake-up call, and it put security awareness training firmly on the procurement map.

The problem CMMC was built to solve

Before CMMC, defense contractors were required to implement the controls in NIST SP 800-171 and self-attest that they had done so. The problem was that self-attestation often bore little resemblance to reality. Contractors signed off on compliance without actually implementing the controls, and there was no verification mechanism to catch the gaps. The result was a supply chain riddled with weaknesses, and sensitive defense information sitting in systems that were nowhere near as secure as the paperwork claimed. CMMC was the DoD's answer: move from trust to verification.

The five levels

CMMC 1.0 introduced five maturity levels, each building on the last. Level 1 required basic cyber hygiene, the fundamentals every contractor should have. Levels 2 and 3 introduced progressively more sophisticated practices drawn from NIST SP 800-171. Levels 4 and 5 targeted advanced, proactive capabilities for the most sensitive programs. Each level added practices and processes, and contractors had to achieve the level required by the specific contracts they pursued. The tiered structure meant that cybersecurity maturity became a competitive differentiator, not just a compliance box.

Where training fit in the model

Security awareness training was baked into CMMC from the foundational levels, because it is a core control in NIST SP 800-171. Even at Level 1, the basic hygiene level, contractors were expected to provide security awareness training to their personnel so they understood their responsibilities. The inclusion of training at the lowest level was significant: it signaled that the DoD considered a trained workforce a baseline expectation, not an advanced capability. For small contractors that had never run a formal training program, this was a genuine new obligation.

Why contractors took notice

CMMC got the attention of the defense industrial base for a simple reason: it tied cybersecurity to revenue. A contractor that could not achieve the required maturity level could not win the contract, full stop. This was a fundamental shift from the self-attestation era, where compliance failures rarely had immediate business consequences. Suddenly, the quality of a contractor's security program, including whether its people were trained, became a direct factor in whether it could win and keep work.

The road to CMMC 2.0

CMMC 1.0 was ambitious, and its rollout generated real friction. Contractors, especially small businesses, pushed back on the cost and complexity of the five-level model and the requirement for third-party assessments. The DoD listened, and in late 2021 it announced CMMC 2.0, a streamlined version that reduced the levels to three and eased the assessment burden. But the core idea, and the training requirement, survived. The revision was a refinement, not a retreat, and the principle that cybersecurity maturity would be verified, not just asserted, became permanent.

The legacy of CMMC 1.0

CMMC's real legacy was to establish that cybersecurity could be a condition of doing business, and that the burden of proof rests on the organization to demonstrate its posture, not on the customer to trust it. That idea spread far beyond defense, into the insurance market and other sectors, where evidence of controls increasingly determined access and pricing. For organizations everywhere, the lesson was the same one defense contractors learned in 2020: security maturity is no longer a technical detail, it is a business requirement, and a trained workforce is one of the clearest indicators of it.